This approach has been adopted in production within the Privado.iD Self-Sovereign Identity ecosystem implemented by IdyllicVision. Sincere thanks to Oleksandr Brezhniev and Vlad Munin for their review and feedback, and to David Rodriguez for development support.
Introduction This article describes a deployment scheme that allows publishing a set of contracts at consistent and identical addresses across multiple EVM networks, reducing the complexity of network-specific configurations in client applications. Consistent addresses are not tied to a particular initialization bytecode of the final implementation. The deployer controls which contract resides at a given address, allowing identical or different addresses as appropriate.
Main advantages Prevents accidental deployments of incorrect contracts; guarantees address stability between versions; protects against front running; allows adding new networks at any time without breaking the scheme.
Step 1. Prepare a proxy contract For each target contract that must have a consistent address, a proxy contract with predictable and deterministic initialization bytecode is deployed. The example uses OpenZeppelin's TransparentUpgradeableProxy. The proxy admin can be set to the zero address if upgrade capability is not required, or a different delegation logic can be used. Instead of relying on setting the Solidity version and compiler options, it is more robust to directly encode the proxy's init bytecode in the configuration to ensure consistency.
Step 2. Deterministic management of constructor arguments Constructor arguments appended to the end of the init bytecode must be managed deterministically. The TransparentUpgradeableProxy constructor takes the parameters address _logic, address initialOwner, and bytes memory _data. The address _logic parameter points to the address of the initial implementation behind the proxy, but using the real implementation is not ideal because its init bytecode can change over time due to compiler versions or optimizations. The robust alternative is to use a dummy implementation that does nothing and always returns successfully for any calldata. This dummy contract is deployed deterministically using CREATE2 and acts as a per-network singleton. It can be extremely minimalist. For example, an init bytecode like 0x6005600C60003960056000F360006000F3 produces runtime bytecode 0x60006000F3, which corresponds to PUSH1 0x00 PUSH1 0x00 RETURN, meaning it always returns an empty array and never reverts. The address initialOwner must be consistent across all networks; security note: if this private key is compromised, an attacker could front-run deployments on new networks. The bytes memory _data argument contains the calldata for the initial call from the proxy constructor. Since the dummy implementation always succeeds, this field is used to differentiate consistent addresses per contract; for example, the UTF-8 hex of strings like consistent.governance and consistent.vault can be used to distinguish between Governance and Vault. This achieves identical init bytecode and arguments on each network, ensuring deterministic and consistent addresses.
Step 3. Deploy the real implementation Finally, the real implementation is deployed and the proxy is upgraded to point to it. The separation between proxy deployment and final upgrade minimizes risk windows and allows most deployment transactions to be executed from addresses without access to the initialOwner's private key; only the final upgrade operation requires owner authorization, facilitating the design of flows with separate roles for deployers and superadmins.
Implementation example Examples exist in contracts from projects like Iden3 in deployment modules, but the idea described here can be applied as a universal pattern for arbitrary contract systems that need consistent addresses across EVM networks.
Considerations and improvements For CREATE2 singleton factories, CreateX or a permissionless CREATE2 factory that provides improvements can be used. All deployment transactions up to the proxy can be executed from any account except the final upgrade operation. Converting the initialOwner into a Smart Account that supports delegation according to EIP-7702 provides flexibility to delegate upgrade rights without exposing the original private key. It should be noted that some compatible EVM networks, for example zkSync, may use a different CREATE2 hashing mechanism, resulting in different deterministic addresses and breaking unification. It is also possible to assign a custom CREATE2 salt to each consistent address to obtain recognizable and useful addresses during development and integration.
Security and operations The pattern minimizes front-running risks by separating proxy deployment from the final upgrade and by using a per-network dummy singleton. Recommend best practices such as safeguarding the initialOwner key in secure solutions, using smart accounts for delegation, and auditing the proxy and real implementation bytecode before the upgrade.
Q2BSTUDIO Q2BSTUDIO is a custom software and application development company specialized in enterprise solutions and blockchain technology. We offer custom software, custom applications, and advanced integrations, with expertise in artificial intelligence and cybersecurity. We provide AWS and Azure cloud services, business intelligence services, and Power BI consulting. We implement AI solutions for companies, including custom AI agents and intelligent automation for critical workflows. Our approach combines security, scalability, and agile delivery so organizations can adopt cutting-edge technology without compromising governance or data protection.
Keywords and positioning custom applications custom software artificial intelligence cybersecurity AWS and Azure cloud services business intelligence services AI for companies AI agents Power BI
Contact and next steps If you would like advice on implementing secure and version-agnostic deployments to consistent addresses on multiple EVM networks, or integrating artificial intelligence, AI agents, cloud solutions, and Power BI analytics into your stack, Q2BSTUDIO offers consulting, development, and custom integration for your project.
